PT-2026-60195 · Directus · Directus

CVE-2026-61836 · Published 2026-07-15 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 12.0.0

Description When response caching is enabled, the cache-key derivation process in the get-cache-key.ts file omits critical authorization context, including share, role, roles, admin, app, and policies. Because share tokens and anonymous requests may both be identified as user null, different shares or anonymous clients requesting the same URL and query may receive a cached response filtered for a different user's permissions without a new permission evaluation.

Recommendations Update to version 12.0.0.

Exploit

Fix

DoS

IDOR

Weakness Enumeration

CWE-524

CWE-639

Related Identifiers

CVE-2026-61836

GHSA-C6W9-5G5J-JH2P

Affected Products

Directus

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61836.json · Exploit
• https://github.com/directus/directus/commit/7ba4efb97525d3af33570537c76e44baea767f13 · Patch
• https://github.com/directus/directus/pull/27707 · Patch
• https://github.com/directus/directus/security/advisories/GHSA-c6w9-5g5j-jh2p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c6w9-5g5j-jh2p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61836 · Security Note
• https://osv.dev/vulnerability/CVE-2026-61836 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/releases/tag/v12.0.0 · Note
• https://t.me/cveNotify/225777 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61836 · Note